[SECURITY] SBOM generation pipeline for contracts and backend (#1531) #503
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Frontend Tests | |
| on: | |
| pull_request: | |
| paths: | |
| - 'frontend/**' | |
| - '.github/workflows/frontend-tests.yml' | |
| - 'docs/CONTRIBUTING.md' | |
| push: | |
| branches: | |
| - main | |
| - develop | |
| paths: | |
| - 'frontend/**' | |
| - '.github/workflows/frontend-tests.yml' | |
| - 'docs/CONTRIBUTING.md' | |
| jobs: | |
| frontend-tests: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| cache: npm | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Install dependencies | |
| working-directory: ./frontend | |
| run: npm ci | |
| - name: Run frontend unit tests with coverage | |
| working-directory: ./frontend | |
| run: npm run test:coverage | |
| - name: Upload frontend coverage artifact | |
| if: success() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: frontend-coverage | |
| path: frontend/coverage/ | |
| if-no-files-found: warn | |
| visual-regression: | |
| runs-on: ubuntu-latest | |
| env: | |
| CI: 'true' | |
| NODE_ENV: test | |
| STELLAR_NETWORK: testnet | |
| STELLAR_HORIZON_URL: https://horizon-testnet.stellar.org | |
| STELLAR_CONTRACT_ADDRESS: CAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA | |
| DEMO_MODE: 'true' | |
| ALLOW_DEMO_BALANCE_FALLBACK: 'true' | |
| JWT_SECRET: visual-ci-jwt-secret-at-least-32-characters-long | |
| DB_PATH: ./data/visual-regression.db | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| cache: npm | |
| cache-dependency-path: frontend/package-lock.json | |
| - name: Install dependencies | |
| working-directory: ./frontend | |
| run: npm ci | |
| - name: Install backend dependencies | |
| working-directory: ./backend | |
| run: npm ci | |
| - name: Install Playwright Chromium | |
| working-directory: ./frontend | |
| run: npx playwright install --with-deps chromium | |
| - name: Start backend for visual routes | |
| working-directory: ./backend | |
| env: | |
| PORT: 3001 | |
| run: | | |
| npm run build | |
| npm start & | |
| ok=0 | |
| for i in $(seq 1 30); do | |
| if curl -sf http://localhost:3001/health > /dev/null; then | |
| ok=1 | |
| break | |
| fi | |
| sleep 2 | |
| done | |
| if [ "$ok" != 1 ]; then | |
| echo "::error::Backend did not become healthy on http://localhost:3001/health" | |
| exit 1 | |
| fi | |
| - name: Run visual regression snapshots | |
| working-directory: ./frontend | |
| env: | |
| VITE_API_URL: http://localhost:3001 | |
| VITE_E2E_MOCK_WALLET: 'true' | |
| run: npm run test:e2e:visual | |
| - name: Upload Playwright visual report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: playwright-visual-report | |
| path: frontend/playwright-report/ | |
| if-no-files-found: warn | |
| - name: Upload visual diff artifacts | |
| if: failure() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: playwright-visual-diffs | |
| path: frontend/test-results/ | |
| if-no-files-found: warn | |
| slack-notification: | |
| name: Notify Slack on failure | |
| needs: [frontend-tests, visual-regression] | |
| if: always() && contains(needs.*.result, 'failure') && github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Send Slack Notification | |
| run: | | |
| curl -X POST -H 'Content-type: application/json' \ | |
| --data "{\"text\":\"🚨 CI Failure on main!\n*Repo*: ${{ github.repository }}\n*Branch*: ${{ github.ref_name }}\n*Failing Step*: ${{ github.workflow }}\n*Link*: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\"}" \ | |
| ${{ secrets.SLACK_WEBHOOK_URL }} |